0

In the recent years I've gotten more paranoid of spying and hacking, so I've encrypted most of my important files just in case. Tax information, some company confidential information, account logins, and even my family photos.

While this does ease most of my concerns, the files are still accessible by anyone who comes across the directories or scans the drive for information.

Is there any way to hide the data on a drive, yet have it accessible only to me?

I know that when you "delete" a file, what really happens is the pointer to the file is removed, but the information exists on the drive until it is overridden. Is there any way to do this but not worry about the file being overridden?

Or what about something that not just hides the file, but hides the fact the file is there in the first place? I know that software like Recuva exists that can search your drive for possible files and is able to recover them. Would there be any way to hide the file so that there would be no feasible way to find the hidden files?

I'm ideally looking for something with full plausible deniability. Not something that is hard to get to, but that you wouldn't even be able to find it even if you looked for it. Full drive encryption, TrueCrypt volumes, and unmounted/encrypted partitions can still be found, even if they can't be decrypted.

Improve this question
11
  • 1
    TrueCrypt (and its variants) has a "hidden volume" option - have you looked at that kind of approach?
    – schroeder ♦
    Aug 20, 2015 at 16:48
  • 1
    Please consider the full threat chain. You may be assumed to be hiding stuff by looking at your IT Security SE profile and finding this very question.
    – Deer Hunter
    Aug 20, 2015 at 18:10
  • 1
    Actually no, you cannot determine if a hidden partition exists in Truecrypt. If you tried to copy 900MB to the non-hidden partition as in your example, the copy would succeed but the hidden partition and all its data would simply become corrupted and unrecoverable. With only the password to the non-hidden partition, the hidden one just seems to be random data/free space which TC will happily overwrite. This is why they call it "plausible deniability" - there is no way to prove that a hidden volume exists without cracking its password, so you can plausibly deny its existence.
    – tlng05
    Aug 20, 2015 at 19:48
  • 1
    I guess the best way is to hide the encrypted files inside in a image and burn it on a external hard drive/CD whatever. Then hidden this CD too. Even if someone find it they'll only see the funny pictures of your cat
    – Freedo
    Aug 20, 2015 at 22:06
  • 1
    Just store this CD in your book's family album or something like that. They would probably stop to do deep search on the CD's after 20 or so CD's....but I'm not a expert and i don't know how easy is to find a hidden image but you could still argue that somone else emailed you this image or you downloaded it from web and keep innocent data encrypted with a different password. If they torture you'll reveal the key to the innocent data and stop looking(or not)
    – Freedo
    Aug 21, 2015 at 0:11

2 Answers 2

Reset to default
1

I believe requiring full plausible deniability leaves only Steganography:

  • Hide in images (approach of Freedo)

  • Hidden TrueCrypt partition (this is basically Steganography as well, on a (visible) partition instead of an image)

However there is one big problem with these approaches, the software to read (and most often also write) the data must not be found. If you want everything on local disk (or other local media like CD's) this is actually a big problem as the presence of such application will raise suspicion and might very likely destroy your plausible deniability.

The solution I see for this is to download the application every time you need it but then you need a way to leave as few trails as possible. Systems like the Tor network should provide a solution here, the presence of Tor should in my opinion not undermine the plausible deniability.

And be sure to be very thorough in removing the application after using it as a lot of applications leave traces behind after removal.

Improve this answer
-2

While I understand your concerns, I believe a more appropriate approach for you if you wish to be security conscious is full disk encryption, or FDE. With the price and performance of SSDs nowadays, FDE is the way to go as the overhead is negligible in most cases. If you have a Mac, an FDE solution is provided for free via FileVault (utilizing XTS-256 I believe), and the same goes for Windows with BitLocker. Of course, there are many other solutions available, these are just 2 of the included ones with these 2 operating systems. It is true that if you aren't utilizing full disk encryption, nothing is stopping someone from booting up your computer and taking your encrypted files (as well as your unencrypted files) although they are going to have a tough time getting into your encrypted files depending on the type of encryption being used. When using FDE, the entire drive is encrypted in the background so you don't need to worry about encrypting individual files. If someone were to take your PC, boot up an imaging tool via DVD or USB, and try to image your drive to obtain your files, they aren't going to get very far. In addition, with SSDs, when you delete a file, the TRIM command is sent by the OS to inform the SSD to wipe that data portion of the drive. What this means is that in most cases, you don't need to sit around and wait for that file to be overwritten like you would a tradition HDD.

Improve this answer
2
  • Not exactly what I was looking for. Ideally, I'd want something that would be hidden. While unlikely, think of a scenario where someone would beat you up until you give your password. If they couldn't see that any files were encrypted, or that the drive itself wasn't encrypted, then you wouldn't get beat up. I don't have anything that important to hide so just call me paranoid.
    – Thatguypat
    Aug 20, 2015 at 17:22
  • 2
    OP's threat model includes the problem that "the files are still accessible by anyone who comes across the directories or scans the drive for information". This implies that the attack is performed while the computer is running. In that scenario, FDE buys you nothing. FDE protects data at rest while the container is locked (or rather, not unlocked, as it is usually the unlocking that is an active step). Additionally, FDE hardly offers "full plausible deniability". See e.g. LUKS FAQ section 5.18.
    – user
    Aug 20, 2015 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .